You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by bu...@bugzilla.spamassassin.org on 2018/09/17 13:10:43 UTC
[Bug 7621] New: GPG signature should be sufficient for update
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7621
Bug ID: 7621
Summary: GPG signature should be sufficient for update
Product: Spamassassin
Version: 3.4.2
Hardware: PC
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: sa-update
Assignee: dev@spamassassin.apache.org
Reporter: bluewind@xinu.at
Target Milestone: Undefined
I've just upgraded to 3.4.2 and noticed that some third-party channels fail to
update. Apparently they only provide a SHA1 hash and no 256 or 512 hashes. They
also provide a GPG signature.
I wonder why sa-update requires both, a hash and the GPG signature, if GPG
support is enabled. The GPG signatures provides much stronger verification than
a simple hash so I think it should be sufficient for accepting a channel.
The relevant code part is line 799 in sa-update which reads: "unless ($content
&& ( $SHA512 || $SHA256 ) && (!$GPG_ENABLED || $GPG)) {"
An example log for the ZMI channel:
Sep 17 14:55:05.459 [3195] dbg: channel: selected mirror
http://zmi.sa-channels.pccc.com
Sep 17 14:55:05.459 [3195] dbg: http: url:
http://zmi.sa-channels.pccc.com/398.tar.gz
Sep 17 14:55:05.459 [3195] dbg: http: downloading to:
/var/lib/spamassassin/3.004002/sa_zmi_at/398.tar.gz, update
Sep 17 14:55:05.459 [3195] dbg: util: executable for curl was found at
/usr/bin/curl
Sep 17 14:55:05.459 [3195] dbg: http: /usr/bin/curl -s -L -O --remote-time -g
--max-redirs 2 --connect-timeout 30 --max-time 300 --fail -o 398.tar.gz -z
398.tar.gz -- http://zmi.sa-channels.pccc.com/398.tar.gz
Sep 17 14:55:05.872 [3195] dbg: http: process [3233], exit status: exit 0
Sep 17 14:55:05.872 [3195] dbg: http: url:
http://zmi.sa-channels.pccc.com/398.tar.gz.sha512
Sep 17 14:55:05.872 [3195] dbg: http: downloading to:
/var/lib/spamassassin/3.004002/sa_zmi_at/398.tar.gz.sha512, new
Sep 17 14:55:05.873 [3195] dbg: util: executable for curl was found at
/usr/bin/curl
Sep 17 14:55:05.873 [3195] dbg: http: /usr/bin/curl -s -L -O --remote-time -g
--max-redirs 2 --connect-timeout 30 --max-time 300 --fail -o 398.tar.gz.sha512
-- http://zmi.sa-channels.pccc.com/398.tar.gz.sha512
Sep 17 14:55:06.070 [3195] dbg: http: process [3235], exit status: exit 22
Sep 17 14:55:06.071 [3195] dbg: channel: No sha512 file available from
http://zmi.sa-channels.pccc.com
Sep 17 14:55:06.071 [3195] dbg: http: url:
http://zmi.sa-channels.pccc.com/398.tar.gz.sha256
Sep 17 14:55:06.071 [3195] dbg: http: downloading to:
/var/lib/spamassassin/3.004002/sa_zmi_at/398.tar.gz.sha256, new
Sep 17 14:55:06.071 [3195] dbg: util: executable for curl was found at
/usr/bin/curl
Sep 17 14:55:06.071 [3195] dbg: http: /usr/bin/curl -s -L -O --remote-time -g
--max-redirs 2 --connect-timeout 30 --max-time 300 --fail -o 398.tar.gz.sha256
-- http://zmi.sa-channels.pccc.com/398.tar.gz.sha256
Sep 17 14:55:06.267 [3195] dbg: http: process [3238], exit status: exit 22
Sep 17 14:55:06.267 [3195] dbg: channel: No sha256 file available from
http://zmi.sa-channels.pccc.com
Sep 17 14:55:06.267 [3195] dbg: http: url:
http://zmi.sa-channels.pccc.com/398.tar.gz.asc
Sep 17 14:55:06.267 [3195] dbg: http: downloading to:
/var/lib/spamassassin/3.004002/sa_zmi_at/398.tar.gz.asc, update
Sep 17 14:55:06.267 [3195] dbg: util: executable for curl was found at
/usr/bin/curl
Sep 17 14:55:06.267 [3195] dbg: http: /usr/bin/curl -s -L -O --remote-time -g
--max-redirs 2 --connect-timeout 30 --max-time 300 --fail -o 398.tar.gz.asc -z
398.tar.gz.asc -- http://zmi.sa-channels.pccc.com/398.tar.gz.asc
Sep 17 14:55:06.467 [3195] dbg: http: process [3252], exit status: exit 0
channel: could not find working mirror, channel failed
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7621] GPG signature should be sufficient for update
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7621
RW <rw...@googlemail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |rwmaillists@googlemail.com
--- Comment #2 from RW <rw...@googlemail.com> ---
To be fair to the OP, it wouldn't weaken verification at all. A .sha256 file is
as easy to forge and replace as a .tar.gz file, so one can't vouch for the
other. The hash file is needed because if you use --nogpg then failing the hash
check prevents sa-update trying to install a corrupt .tar.gz file (typically a
truncated file from a failed download).
I'm not advocating change though, as it should be easy for actively maintained
channels to add an extra hash file, and keeping the unnecessary hash check
makes sa-update a bit easier to debug.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7621] GPG signature should be sufficient for update
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7621
--- Comment #3 from Kevin A. McGrail <km...@apache.org> ---
Agreed but the combination of both is a stance we decided on in 2004 and has
served us well. Changing what our project does to accommodate a third party
when the fix is a simple creation of a sha256 file is my point.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7621] GPG signature should be sufficient for update
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7621
Kevin A. McGrail <km...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |kmcgrail@apache.org
Status|NEW |RESOLVED
Resolution|--- |WONTFIX
--- Comment #1 from Kevin A. McGrail <km...@apache.org> ---
Sorry but please contact the 3rd party rule makers and get them to implement
sha256 and/or 512.
I don't see us weakening the verification step.
--
You are receiving this mail because:
You are the assignee for the bug.